feat(paseo): bump pinned Paseo CLI to 0.12.0 - #504

AI-assisted review (OpenCode), verified independently against head 1646a82c5fb484d5594ff70d5c8396ae74533671.

Approving. I reviewed this in an isolated worktree and verified every load-bearing claim by execution rather than by reading the release notes.

Verified

Pin consistency. All three live occurrences agree at 0.12.0: spec.yaml:189, and the comment plus _ver default at files/home/paseo-start.sh:35,81. A repo-wide sweep for 0.10.2 returns only the historical CHANGELOG.md:59 release entry.

Publication and integrity. @getpaseo/[email protected] is published and resolvable, latest, 2026-10-19T06:48:31Z. The kit's integrity chain is unchanged from 0.10.2: version pin, registry.npmjs.org over the proxy, npm's own dist.integrity. There is no npm provenance attestation for either 0.12.0 or 0.10.2, so nothing regressed.

Cited breaking changes do not reach the kit. Grepping the whole kit, plugin, --background, no-wait, and permit have zero invocation sites. The only CLI calls are paseo daemon config set, paseo daemon run, paseo daemon restart, and paseo --version.

Daemon surface. I unpacked both tarballs and diffed them. commands/daemon/{start,status,stop,reload,pair,config,local-daemon,index}.js, daemon-worker.js, daemon-instance.js, daemon-config-store.js, auth.js, and utils/client.js are byte-identical, and the HTTP route table is unchanged. The three settings asserted in paseo-assert-daemon-config.mjs still parse and default identically.

Offline gates. validate-kits.py --strict 10 kits plus 2 templates, paseo node tests 16/16, kit scripts/verify 8/8, validate_repo.py, INDEX/CATALOG --check, scan_unsafe_shell.py, and pytest scripts/ 483 passed. Markdown lint is unmeasured here because .github/linters/node_modules is absent and I could not install offline; CI covers it and is green 7/7.

Two corrections to the PR body, neither blocking

commands/daemon/restart.js is not unchanged. It has one substantive delta: the replacement-worker status probe moved from timeout: Math.min(1000, remaining()) to timeout: remaining(). The CLI surface is unchanged, so the claim holds in spirit. This delta matters for your observed flake, and it points the right way, see below.

0.12.0 unconditionally loads twelve bundled plugins at daemon boot, before the pluginsEnabled gate that governed this in 0.10.2. Three of them reach api.openai.com, code.claude.com, and opencode.ai, which the kit's allowlist does not permit, so the proxy resets them. Residual risk is low: the sandbox holds no Claude, Codex, or OpenCode-Go credentials, USAi injects via env rather than auth.json, the relay is already disabled, and each plugin start is individually caught and logged. I also confirmed empirically that esbuild works under the kit's npm_config_ignore_scripts=true, because the platform binary resolves through script-free optional deps. Worth a documentation note so the next reader does not re-derive it.

On the intermittent restart failure

Your one-off is consistent with a known mechanism, and 0.12.0 is the fix side of it. restart.js confirms by reconnecting and comparing worker PIDs; under 0.10.2 that status probe was capped at one second while daemon status enumerates every provider through PATH resolution. On a cold first boot that cap is easy to exceed, producing RESTART_NOT_CONFIRMED even though the restart landed, which is exactly what you saw. 0.12.0 raises the cap to the full remaining deadline, so this should get less frequent rather than more.

The residual edge is in the kit's fallback, not in Paseo: files/home/paseo-agent-shim:131-146 kills every non-marker paseo daemon run and unlinks paseo.pid whenever the CLI reports failure. When the restart actually succeeded, that tears down a healthy worker. It is bounded and self-healing, and you observed the recovery, but in a sandbox with a live agent session it would kill that session. Pre-existing and not introduced here.

Suggested follow-ups, not changes to this PR

1. Document the always-on bundled-plugin layer at 0.12.0, the three out-of-allowlist hosts, and the verified esbuild-under---ignore-scripts behavior.
2. Harden the paseo-agent-shim fallback to confirm the daemon is genuinely wedged before the kill-and-unlink path.
3. Add a validator assertion that spec.yaml's PASEO_CLI_VERSION equals the paseo-start.sh fallback default. Nothing currently enforces the documented two-value edit.

I did not run the live RUN_ACQ=1 path; no acq or msb backend is available in this environment, so your live verification is the only end-to-end evidence and I take it as reported.